Subject: [TLS] Multiple records in record limit (was: Secdir review)

From: Martin Thomson <[email-masked]>
Date: Mon, 26 Feb 2018 12:39:02 +1100

Out of the secdir review (thanks again Alan!), I realized that the
draft never actually said this:

   PMTU governs the size of UDP datagrams, which limits the size of records, but
   does not prevent records from being smaller.  An endpoint that sends small
   records is still able to send multiple records in a single UDP datagram.

I think that I should add that explanation.

Does anyone think that this should go further and advise against
putting multiple records in the same datagram?

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 25 Feb 2018 18:12:32 -0800

I think this is the right answer.

-Ekr

On Sun, Feb 25, 2018 at 5:39 PM, Martin Thomson <[email-masked]>
wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Mon, 26 Feb 2018 11:28:18 +0100

> putting multiple records in the same datagram?

I'm not sure which part of the protocol text this would refer to, but
DTLS1.2 says in https://tools.ietf.org/html/rfc6347#section-4.1.1

```
   Multiple DTLS records may be placed in a single datagram.  They are
   simply encoded consecutively. 
```

so even though I agree that the advice against putting multiple records
in the same datagram is a good one (I'm not even sure if that works
today with existing implementations), the advice seems against the
original protocol. Shouldn't that text be in the upcoming DTLS1.3
rather than an update like record size limit which seems unrelated?

regards,
Nikos

---

From: Alan DeKok <[email-masked]>
Date: Mon, 26 Feb 2018 10:48:35 -0500

> putting multiple records in the same datagram?

  Yes.  I don't think there's any good reason for that kind of behaviour.

  Alan DeKok.

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 26 Feb 2018 08:11:15 -0800

>   Yes.  I don't think there's any good reason for that kind of behaviour.

There actually are. One example is packing handshake and data records in
the same datagram.

-Ekr